Publish from green CI instead of re-gating at the tag #63

guard-core-rs v4.4.0 could not reach crates.io because its release workflow re-ran lint and tests at the tag on the MSRV toolchain, which pull request CI never ran, and its manual re-drive compared GITHUB_REF_NAME to the crate version, so it could only run from the failing tag. guard-agent-rs has the same release workflow shape. It should publish only a tag whose push CI already passed, take the tag as an input for a manual re-drive, and CI should lint on the MSRV toolchain too.